fix: harden Pi management readiness

backend/test/provider-credentials.test.ts

@@ -5,6 +5,7 @@ import {
   PI_0803_CREDENTIAL_ENV_NAMES,
   buildPiChildEnv,
   canonicalPiProvider,
+  piProviderCredentialStatus,
 } from "../src/pi/provider-credentials.js";
 
 test("canonical provider aliases resolve to packaged Pi 0.80.3 IDs", () => {
@@ -130,6 +131,19 @@ test("local-qwen is an explicit local provider and needs no generic key", () =>
   expect(env).not.toHaveProperty("THT_MODEL_API_KEY_FILE");
 });
 
+test("credential status reports only present or missing without treating local providers as credentialed", () => {
+  expect(piProviderCredentialStatus({
+    provider: "deepseek",
+    authProviders: new Set(["deepseek"]),
+    credentialValue: "must-not-be-returned",
+  })).toBe("present");
+  expect(piProviderCredentialStatus({ provider: "deepseek" })).toBe("missing");
+  expect(piProviderCredentialStatus({
+    provider: "local-qwen",
+    credentialValue: "must-not-be-returned",
+  })).toBe("missing");
+});
+
 test("bundle value is injected without exposing bundle metadata to Pi", () => {
   const env = buildPiChildEnv({
     ambient: {